In this guide · 7 sections
Short answer
p=none only monitors, p=quarantine asks receivers to send failing mail to spam, and p=reject asks them to refuse it. Start at none with reports switched on, fix every legitimate sender, then move to quarantine and finally reject. Only quarantine and reject actually stop spoofing.
The three DMARC policies in plain English
DMARC is a DNS record at _dmarc.yourdomain.com. It tells receiving mail servers what to do with a message that claims to be from your domain but fails both SPF and DKIM alignment. If you need the basics of SPF and DKIM first, start with our guide to SPF, DKIM and DMARC.
| Policy | What receivers are asked to do | Protects against spoofing? |
|---|---|---|
| p=none | Nothing; deliver as normal and send you reports | No |
| p=quarantine | Treat failing mail as suspicious, usually the spam folder | Partly |
| p=reject | Refuse failing mail, typically with a bounce | Yes |
Microsoft's DMARC guide describes p=none as the value for testing and tuning, and says the goal is p=reject for all your custom domains and subdomains. Receivers make the final decision, but major providers follow the policy closely.
How to read DMARC aggregate reports
The rua tag in your record tells receivers where to send daily aggregate reports. Google recommends a dedicated mailbox or group, or a DMARC reporting service, because a busy domain can receive many reports a day. The reports are XML files, so most businesses use a free or low-cost tool that turns them into a table.
Each report row tells you a sending IP address, how many messages it sent as your domain, whether SPF and DKIM passed and aligned, and what the receiver did. Read them like this:
- Passing, from a service you know (your Microsoft 365 or Google Workspace, your newsletter tool): good, nothing to do.
- Failing, from a service you know: a legitimate sender that is not set up yet. Fix it before you enforce.
- Failing, from servers you do not recognise: usually spoofing or spam using your domain. This is what quarantine and reject will block.
- Forwarded mail: messages forwarded by mailing lists or other mailboxes can fail SPF. DKIM normally survives forwarding, which is why DKIM matters.
Find every service that sends email as your domain
This is the step that decides whether p=reject goes smoothly. Google's DMARC set-up page says any third-party service that sends for you must pass SPF and DKIM with your domain. In a small business, the usual list looks like this:
Senders to check before enforcing
For each one, set up DKIM signing with your domain in that tool's settings (usually by adding CNAME or TXT records), and add it to SPF only if the tool tells you to. Watch the 10-lookup limit on SPF. If a tool cannot authenticate as your domain, have it send from its own domain or a subdomain instead.
A staged timeline from p=none to p=reject
Google's recommended DMARC rollout is to start at none for at least one week, then move to quarantine and then reject. One week is the minimum. For a small business with monthly invoicing runs or quarterly newsletters, we suggest watching for a full month so those senders appear in the reports.
Week 0: publish p=none with reports
Example: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Make sure SPF and DKIM have been working for at least 48 hours first, as Google advises.
Weeks 1-4: list and fix senders
Go through the reports weekly. Fix each legitimate sender that fails. Do not move on while known senders still fail.
Month 2: move to p=quarantine
Change to p=quarantine. Watch reports and ask staff to report any customer saying your mail went to spam.
Month 3: move to p=reject
When quarantine reports show only unknown senders failing, change to p=reject. Keep the rua address so you keep seeing what is blocked.
Set subdomain and parked-domain policies
Subdomains inherit p unless you set sp. Microsoft recommends p=reject on domains that never send email, including an unused onmicrosoft.com domain.
pct, sp and the 2026 DMARC standard change
Older guides, and Google's and Microsoft's own pages, show the pct tag, for example pct=25 to apply quarantine to a quarter of failing mail. In May 2026 the IETF published RFC 9989, the new DMARC standard that replaces RFC 7489. It removes pct, noting that receivers usually did not apply values other than 0 or 100 accurately.
RFC 9989 adds a test-mode tag instead: t=y asks receivers to apply one level below your policy, so p=reject; t=y is handled like quarantine. Receivers still on the old standard ignore t, so do not rely on it as an off switch. In practice, for a small business the safest approach is to stage by time (none, then quarantine, then reject) rather than by percentage.
| Tag | What it does | Small business advice |
|---|---|---|
| sp | Policy for subdomains | Leave it out so subdomains inherit p, unless a subdomain sends from an unauthenticated tool |
| np | Policy for subdomains that do not exist (new in RFC 9989) | np=reject is a cheap extra protection once you enforce |
| pct | Percentage of failing mail the policy applies to | Removed in RFC 9989; avoid values other than 100 |
| t | Test mode, one level softer (new in RFC 9989) | Optional; older receivers ignore it |
| adkim / aspf | Strict or relaxed alignment | Keep the default relaxed unless you have a reason |
Do it yourself or get help?
If you send only from Microsoft 365 or Google Workspace and one newsletter tool, you can follow the timeline above yourself with a free report viewer. It gets harder when several tools send as your domain, or when you are already seeing delivery problems; see our guide to emails going to spam in Gmail.
Our Emails Land in Spam Fix (S$249) sets up SPF, DKIM and DMARC for every sender and plans the move to reject. If you only need DNS records added or tidied, use Domain & DNS Setup (S$99).
Frequently asked questions
It is safe in the sense that it will not block any of your email. But it gives no protection against spoofing, because receivers are not asked to act on failing mail. Treat p=none as a monitoring stage of a few weeks while you fix your senders, not as the end state.
Quarantine asks receivers to accept failing messages but treat them as suspicious, usually by putting them in spam or junk. Reject asks receivers to refuse failing messages, so they are not delivered at all. Reject gives the strongest protection against spoofing; quarantine is a useful intermediate step.
Google recommends at least one week at p=none so daily reports cover all your mail streams. For a small business with monthly or occasional senders, such as invoicing runs or quarterly newsletters, a month is safer so those senders appear in the reports before you enforce.
Yes, if a service that sends as your domain is not authenticated. Website forms, invoicing tools and CRMs are the common cases. That is why you monitor reports at p=none first and fix every legitimate sender. Once they all pass SPF or DKIM with alignment, p=reject only affects mail you did not send.
The new DMARC standard, RFC 9989 published in May 2026, removed the pct tag because receivers rarely applied partial percentages accurately. A pct of 100 does nothing harmful. Avoid relying on values between 1 and 99; staging by time from none to quarantine to reject is more predictable.